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■ Describe the new breed of C2C tools 
developed in Applied Research (TR) 

■ Scaling them up through the Next 
Generation Events (NGE) project 



This information is exempt under the Freedom of Inform ation Act 2000 (FOIA) and may be exempt under other U K information legislation 
Refer any FOIA queries to GCFlB 



o 




TOP SECRET STRAP1 

Next Generation Events Roadm 




Convergence 1 



Cloud upscale 



I nternet Profiling 2 







I nternet 
Profiling 1 

-80 x lOg 
-260 experts 



Capability development Large-scale contact 

(including eA) chaining 




Data mining and 
profiling 




New technologies (particularly from JCE) incorporated into solution as they are de-risked / proven 
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NGE Analytical Capabilities 
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Some useful definitions 

■ Presence Event 

■ Describes that an identifier was online, on an IP address, at a point in 
time. 

- Simple, atomic element. 

- Can be very easily developed so are very diverse 

■ Very useful! 

■ TDI = Target Description Identifier 

■ Has a type, eg Yahoo-Y-Cookie 

- And a value, eg toml 23@yahoo 

■ GTDI = Generic Target Detection Identifier 

- Expands the TDI concept to telephony e.g. A GSM location update 
message 
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Some more definitions 




■ BLACK HOLE: The large flat file storage where all the data sits 

- After initial processing, and before being manipulated and correlated 
and loaded into the QFD database tables 

■ QFD: Question Focused Dataset (Database) 

■ One for each tool: MUTANT BROTH, AUTO ASSOC etc 
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Probes 



Flat Storage 



Structured Storage 
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QFD desktop. ..so far... 

■ Enables analysts to: 

■ Create a profile of a target’s online activities (Mutant Broth) 

■ Find other identifiers for a target (Auto Assoc) 

■ Create a social network (Social Animal) 

■ Investigate websites or web forums of interest (Karma Police, 
Infinite Monkeys, HRMAP) 

■ Find out who has been searching the web and for what 
(Memory Hole) 

■ Find out who has been looking at what on Google Earth 
(Marbled Gecko) 
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Converged QFD desktop. ..by Dec... 




■ Enables analysts to: 

■ Create a profile of a target’s online activities alongside 
telephony ( Evolved Mutant Broth) 

■ Find alternative identifiers across telephony and the internet 
(Hard Assoc) 

■ Create a social network including telephony (Evolved Social 
Animal) 

■ Find out what has been happening in real time (Samuel Pepys) 

All available on the desktop via Looking Glass plug-ins and Web 
GUIs 
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Success story -TSS2 Nocon 

■ Slides removed - contact for full 

version 
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Capability Dev Workspace 




I’ve just developed collection of 
My FaceSpace events! 



I’ll put that 
processing on a 
few more 
bearers... 




I’ll just add in some 
of those results... 



User-interface 

specialist 



Analyst with an 
operational problem 



Oh heck, I’ve caught 
Bin Laden 
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Data Mining at scale 




■ Experiments with Cloud ongoing to enable 
analysts to request and run MOAGs (large TNN 
graphs) from the desktop 

■ Distillery will enable analysts to spot real time 
changes to the data at scale (e.g. detection of 
impossible travel) 

■ Joint Collaboration Environment (lnnov8) - 
trialling running of large scale analytics using 
both GCHQ and NSA data 




This information is exempt under the Freedom of Inform ation Act 2000 (FOIA) and may be exempt under other U K information legislation 
Refer any FOIA queries to GChiHIHi^HHHlHfliHHHHHIlHHBHi 




TOP SECRET STRAP1 

Future Implications 

■ We shall be able to: 




■ easily monitor changes in our targets’ profiles and networks 

■ develop and trial new capabilities using real life analytical 
experiments 

■ respond quickly in a crisis 
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Questions? 




^^^^^^^^^WBLAZING_SADDLES 
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